Securing Your Phone Before You Use Public Wi-Fi

Last month a friend told me his email had been accessed from another country the day after he spent an afternoon working from an airport lounge. He had connected to the free Wi-Fi, logged into his email, his bank, a couple of shopping accounts and the site he uses for his weekly football pool. He had no idea which login had been exposed, so he spent the next evening changing every password he owned.

Public Wi-Fi is far safer than it was ten years ago, mostly because nearly every site now uses HTTPS. But it is not risk free, and a few minutes of preparation makes a real difference. Here is the setup I recommend before connecting a phone to any network you do not control.

What the real risks are today

The old fear about public Wi-Fi was that anyone on the same network could read everything you typed. With HTTPS almost everywhere, that is much less likely. The risks that remain are subtler.

Risk	How it happens	How likely
Fake hotspots	Someone sets up a network called Airport Free WiFi and captures what you do	Moderate in busy public places
Phishing login pages	A captive portal or redirect asks you to sign in with an existing account	Moderate
Unencrypted apps	Older or poorly built apps send data without HTTPS	Low but real
Reused passwords	One exposed login unlocks several other accounts	High, and the biggest cause of damage

The last row is the one that matters most. My friend's problem was not really the Wi-Fi. It was that his email, shopping, banking and ankertoto accounts shared two or three variations of the same password, so a single leak anywhere put all of them at risk.

Five settings to check before you connect

Turn off auto join for open networks. Your phone should never connect to a public network without asking. On both iPhone and Android, this is in the Wi-Fi settings.
Enable private or randomized MAC addresses. Modern phones do this by default, but check. It stops networks from tracking your device across visits.
Turn on two factor authentication for email, banking and any account with money in it. This is the single strongest protection if a password leaks.
Use a password manager so every account has a unique password. Our guide on how to set up a password manager safely walks through the setup.
Keep the phone updated. Security patches close holes that attackers on shared networks rely on.

How to spot a fake hotspot

Fake networks are designed to look legitimate. A few habits make them much easier to avoid:

Ask staff for the exact network name rather than choosing the most official looking one.
Be suspicious of two networks with nearly identical names.
Never enter an existing email or social media password to access Wi-Fi. Legitimate venues use a simple terms page or a code.
If a site that normally loads over HTTPS suddenly shows a certificate warning, disconnect.

Checking HTTPS properly is a small skill worth learning. The padlock icon alone does not prove a site is genuine, as explained in how to check HTTPS correctly.

The advice I disagree with: always use a VPN

Almost every article about public Wi-Fi ends with the same instruction: use a VPN. Some go further and suggest a VPN is all you need.

A VPN is useful. It hides your traffic from the local network and makes fake hotspots much less dangerous. But I think the advice is overstated for most people, for three reasons. First, with HTTPS nearly universal, the local network already sees very little of what you do. Second, a VPN does nothing to protect a reused password or stop you typing it into a phishing page. Third, free VPN apps are often worse than no VPN at all, because some collect and sell the very browsing data you were trying to protect.

If you already use a reputable paid VPN, keep using it. But if you have to choose where to spend your effort, unique passwords and two factor authentication protect you far more than a VPN on its own.

Using mobile data instead

The simplest way to avoid public Wi-Fi risks is not to use it. Mobile data plans have become large and cheap enough that for most tasks, especially logging into financial accounts, using your phone's own connection is both safer and easier. If you need to connect a laptop, your phone's personal hotspot with a strong password is usually a better choice than the café network.

I now keep public Wi-Fi for low risk things: streaming, reading news, downloading podcasts. Anything that involves a password or money goes over mobile data.

Change the password for that account immediately, from a trusted network.
Change the password on any other account that used the same or a similar password.
Check the account's recent activity and active sessions, and sign out of all devices.
Turn on two factor authentication if it was not already on.
Watch your email and bank statements closely for a few weeks.

My friend now uses a password manager, has two factor authentication on everything that matters and keeps banking and money related apps off public networks entirely. The airport lounge Wi-Fi is still free. He just uses it for podcasts. More practical security guides are in our Security section.